Browser extension is same problem but smaller. The .crx file is just a zip,
so anyone can open it. But almost everything in the store is bundled and
minified. You can read it, but you are reading the output of a build you
did not run.
So I made mine with no build step at all. The files in the repo are the
files that run. Reason is simple. My extension reads cookies, and I could
not find other way to let someone confirm that the thing reading their
cookies is the thing I published. Unzip the crx, diff with repo, 10 seconds.
Cost is real. No modules, no types, and I had to write some things in a
stupid way. It was acceptable because the code is small. For a big project
this is not possible, so the work in this article is important.
I have some websites (like https://correcthorse.org) that need the users full trust and thus rely on minimal unobfuscated JS so that you can easily verify all the code that gets run by looking at the source and the approximate 10 or 20 lines of clear JS.
So I made mine with no build step at all. The files in the repo are the files that run. Reason is simple. My extension reads cookies, and I could not find other way to let someone confirm that the thing reading their cookies is the thing I published. Unzip the crx, diff with repo, 10 seconds.
Cost is real. No modules, no types, and I had to write some things in a stupid way. It was acceptable because the code is small. For a big project this is not possible, so the work in this article is important.
reply